The NetBSD Project

CVS log for src/sys/net/npf/npf_inet.c

[BACK] Up to [cvs.NetBSD.org] / src / sys / net / npf

Request diff between arbitrary revisions


Default branch: MAIN


Revision 1.54.2.3 / (download) - annotate - [select for diffs], Sat Jun 20 15:46:48 2020 UTC (3 years, 9 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-3-RELEASE, netbsd-9-2-RELEASE, netbsd-9-1-RELEASE
Changes since 1.54.2.2: +5 -3 lines
Diff to previous 1.54.2.2 (colored) to branchpoint 1.54 (colored) next main 1.55 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #956):

	usr.sbin/npf/npf-params.7: revision 1.4
	sys/net/npf/npf_worker.c: revision 1.9
	usr.sbin/npf/npftest/npftest.h: revision 1.17
	usr.sbin/npf/npfctl/npf_bpf_comp.c: revision 1.16
	usr.sbin/npf/npf-params.7: revision 1.5
	sys/net/npf/npf_state_tcp.c: revision 1.21
	usr.sbin/npf/npfctl/npf_build.c: revision 1.55
	usr.sbin/npf/npf-params.7: revision 1.6
	sys/net/npf/npfkern.h: revision 1.5
	lib/libnpf/npf.c: revision 1.49
	usr.sbin/npf/npf-params.7: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.81
	sys/net/npf/npf_ext_log.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.h: revision 1.53
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.50
	sys/net/npf/npf_mbuf.c: revision 1.24
	sys/net/npf/npf_alg.c: revision 1.22
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: file removal
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.10
	sys/net/npf/npf.h: revision 1.63
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.21
	usr.sbin/npf/npfctl/npf_var.c: revision 1.13
	sys/net/npf/files.npf: revision 1.23
	usr.sbin/npf/npfctl/npf_show.c: revision 1.32
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.91
	sys/net/npf/npf_os.c: revision 1.18
	sys/net/npf/npf_connkey.c: revision 1.2
	sys/net/npf/npf_conf.c: revision 1.17
	lib/libnpf/libnpf.3: revision 1.12
	usr.sbin/npf/npftest/npftest.c: revision 1.25
	usr.sbin/npf/npftest/libnpftest/npf_gc_test.c: revision 1.1
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.51
	sys/net/npf/npf_tableset.c: revision 1.35
	usr.sbin/npf/npftest/npftest.conf: revision 1.9
	sys/net/npf/npf_sendpkt.c: revision 1.22
	usr.sbin/npf/npfctl/npf_var.h: revision 1.10
	sys/net/npf/npf_state.c: revision 1.23
	sys/net/npf/npf_conn.h: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.64
	usr.sbin/npf/npfctl/npf_cmd.c: revision 1.1
	sys/net/npf/npf_portmap.c: revision 1.5
	sys/net/npf/npf_params.c: revision 1.3
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.32
	tests/net/npf/t_npf.sh: revision 1.4
	sys/net/npf/npf_ext_rndblock.c: revision 1.9
	lib/libnpf/npf.h: revision 1.39
	sys/net/npf/npf_ruleset.c: revision 1.51
	sys/net/npf/npf_alg_icmp.c: revision 1.33
	sys/net/npf/npf.c: revision 1.43
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.17
	usr.sbin/npf/npfctl/npfctl.8: revision 1.25
	sys/net/npf/npf_ctl.c: revision 1.60
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.18
	usr.sbin/npf/npftest/libnpftest/Makefile: revision 1.11
	sys/net/npf/npf_handler.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.57
	sys/net/npf/npf_ifaddr.c: revision 1.7
	sys/net/npf/npf_conndb.c: revision 1.9
	sys/net/npf/npf_if.c: revision 1.13
	usr.sbin/npf/npfctl/Makefile: revision 1.15
	sys/net/npf/npf_conn.c: revision 1.32
	sys/net/npf/npf_ext_normalize.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.20
	sys/net/npf/npf_worker.c: revision 1.8

Major NPF improvements (merge from upstream):
- Switch to the C11-style atomic primitives using atomic_loadstore(9).
- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.
- npfkern: rewrite the G/C worker logic and make it self-tuning.
- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.
- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.
- Amend and improve the manual pages.

npf_worker_sys{init,fini}: initialize/destroy the exit_cv condvar.

npftest -- npf_test_init(): add a workaround for NetBSD.

npf-params(7): fix the state.key defaults.

npf-params.7: s/filer/filter/

Adjust to "npfctl debug" command line changes, from rmind@.

Use more markup.

Revision 1.57 / (download) - annotate - [select for diffs], Sat May 30 14:16:56 2020 UTC (3 years, 9 months ago) by rmind
Branch: MAIN
CVS Tags: thorpej-ifq-base, thorpej-ifq, thorpej-i2c-spi-conf2-base, thorpej-i2c-spi-conf2, thorpej-i2c-spi-conf-base, thorpej-i2c-spi-conf, thorpej-futex2-base, thorpej-futex2, thorpej-futex-base, thorpej-futex, thorpej-cfargs2-base, thorpej-cfargs2, thorpej-cfargs-base, thorpej-cfargs, thorpej-altq-separation-base, thorpej-altq-separation, netbsd-10-base, netbsd-10-0-RC6, netbsd-10-0-RC5, netbsd-10-0-RC4, netbsd-10-0-RC3, netbsd-10-0-RC2, netbsd-10-0-RC1, netbsd-10, cjep_sun2x-base1, cjep_sun2x-base, cjep_sun2x, cjep_staticlib_x-base1, cjep_staticlib_x-base, cjep_staticlib_x, bouyer-sunxi-drm-base, bouyer-sunxi-drm, HEAD
Changes since 1.56: +5 -3 lines
Diff to previous 1.56 (colored) to selected 1.52 (colored)

Major NPF improvements (merge from upstream):

- Switch to the C11-style atomic primitives using atomic_loadstore(9).

- npfkern: introduce the 'state.key.interface' and 'state.key.direction'
  settings.  Users can now choose whether the connection state should be
  strictly per-interface or global at the configuration level.  Keep NAT
  logic to be always per-interface, though.

- npfkern: rewrite the G/C worker logic and make it self-tuning.

- npfkern and libnpf: multiple bug fixes; add param exporting; introduce
  more parameters.  Remove npf_nvlist_{copyin,copyout}() functions and
  refactor npfctl_load_nvlist() with others; add npfctl_run_op() to have
  a single entry point for operations.  Introduce npf_flow_t and clean up
  some code.

- npfctl: lots of fixes for the 'npfctl show' logic; make 'npfctl list'
  more informative; misc usability improvements and more user-friendly
  error messages.

- Amend and improve the manual pages.

Revision 1.54.2.2 / (download) - annotate - [select for diffs], Mon May 25 17:25:28 2020 UTC (3 years, 10 months ago) by martin
Branch: netbsd-9
Changes since 1.54.2.1: +18 -4 lines
Diff to previous 1.54.2.1 (colored) to branchpoint 1.54 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #930):

	usr.sbin/npf/npfctl/npf_build.c: revision 1.54
	sys/net/npf/npf_conn.h: revision 1.19
	usr.sbin/npf/npfctl/npfctl.h: revision 1.52
	usr.sbin/npf/npfctl/npf_show.c: revision 1.31
	sys/net/npf/npf_conf.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.49
	sys/net/npf/npf_inet.c: revision 1.56
	sys/net/npf/npf_conndb.c: revision 1.8
	sys/net/npf/npf_conn.c: revision 1.31

Backport selected NPF fixes from the upstream (to be pulled up):

- npf_conndb_lookup: protect the connection lookup with pserialize(9),
  instead of incorrectly assuming that the handler always runs at IPL_SOFNET.
  Should fix crashes reported on high load (PR/55182).

- npf_config_destroy: handle partially initialized config; fixes crashes
  with some invalid configurations.

- NAT policy creation / destruction: set the initial reference and do not
  wait for reference draining on destruction; destroy the policy on the
  last reference drop instead.  Fixes a lockup with the dynamic NAT rules.

- npf_nat_{export,import}: fix a regression since dynamic NAT rules.

- npfctl: fix a regression and restore the default group behaviour.

- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).

Revision 1.56 / (download) - annotate - [select for diffs], Sat May 23 19:56:00 2020 UTC (3 years, 10 months ago) by rmind
Branch: MAIN
Changes since 1.55: +18 -4 lines
Diff to previous 1.55 (colored) to selected 1.52 (colored)

Backport selected NPF fixes from the upstream (to be pulled up):

- npf_conndb_lookup: protect the connection lookup with pserialize(9),
  instead of incorrectly assuming that the handler always runs at IPL_SOFNET.
  Should fix crashes reported on high load (PR/55182).

- npf_config_destroy: handle partially initialized config; fixes crashes
  with some invalid configurations.

- NAT policy creation / destruction: set the initial reference and do not
  wait for reference draining on destruction; destroy the policy on the
  last reference drop instead.  Fixes a lockup with the dynamic NAT rules.

- npf_nat_{export,import}: fix a regression since dynamic NAT rules.

- npfctl: fix a regression and restore the default group behaviour.

- Add npf_cache_tcp() and validate the TCP data offset (from maxv@).

Revision 1.50.2.2 / (download) - annotate - [select for diffs], Mon Apr 13 08:05:15 2020 UTC (3 years, 11 months ago) by martin
Branch: phil-wifi
Changes since 1.50.2.1: +42 -18 lines
Diff to previous 1.50.2.1 (colored) to branchpoint 1.50 (colored) next main 1.51 (colored) to selected 1.52 (colored)

Mostly merge changes from HEAD upto 20200411

Revision 1.54.2.1 / (download) - annotate - [select for diffs], Tue Aug 13 14:35:55 2019 UTC (4 years, 7 months ago) by martin
Branch: netbsd-9
CVS Tags: netbsd-9-0-RELEASE, netbsd-9-0-RC2, netbsd-9-0-RC1
Changes since 1.54: +22 -18 lines
Diff to previous 1.54 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #49):

	usr.sbin/npf/npf.7: revision 1.7
	sys/net/npf/npfkern.h: revision 1.4
	sys/net/npf/npf_conn.h: revision 1.18
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.13
	sys/net/npf/npf_ctl.c: revision 1.55
	sys/net/npf/npf_os.c: revision 1.14
	sys/net/npf/npf_conf.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_conn_test.c: revision 1.3
	usr.sbin/npf/npftest/libnpftest/npf_perf_test.c: revision 1.9
	sys/net/npf/npf_impl.h: revision 1.76
	sys/net/npf/npf_portmap.c: revision 1.4
	sys/net/npf/npf_params.c: revision 1.2
	sys/net/npf/npf.c: revision 1.40
	usr.sbin/npf/npftest/libnpftest/npf_test_subr.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.18
	sys/net/npf/npf_nat.c: revision 1.47
	sys/net/npf/npf_handler.c: revision 1.47
	sys/net/npf/npf_inet.c: revision 1.55
	sys/net/npf/npf_if.c: revision 1.10
	sys/net/npf/npf_worker.c: revision 1.7
	usr.sbin/npf/npf-params.7: revision 1.3

npf-params(7): add more bpf.jit details.
From David H. Gutteridge.

Adjust some internal NPF APIs:
* npfkern: use the npfk_ prefix.
* NPF portmap: amend the API so it could be used elsewhere.
* Make npf_connkey_t public.

npf.7: add xref to npf-params.7
(Adding directly here since this particular file isn't included in
rmind@'s upstream GitHub repo at present.)

Revision 1.55 / (download) - annotate - [select for diffs], Sun Aug 11 20:26:34 2019 UTC (4 years, 7 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20200421, phil-wifi-20200411, phil-wifi-20200406, phil-wifi-20191119, is-mlppp-base, is-mlppp, bouyer-xenpvh-base2, bouyer-xenpvh-base1, bouyer-xenpvh-base, bouyer-xenpvh, ad-namecache-base3, ad-namecache-base2, ad-namecache-base1, ad-namecache-base, ad-namecache
Changes since 1.54: +22 -18 lines
Diff to previous 1.54 (colored) to selected 1.52 (colored)

Adjust some internal NPF APIs:
* npfkern: use the npfk_ prefix.
* NPF portmap: amend the API so it could be used elsewhere.
* Make npf_connkey_t public.

Revision 1.54 / (download) - annotate - [select for diffs], Tue Jul 23 00:52:01 2019 UTC (4 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-9-base
Branch point for: netbsd-9
Changes since 1.53: +21 -1 lines
Diff to previous 1.53 (colored) to selected 1.52 (colored)

NPF improvements:
- Add support for dynamic NETMAP algorithm (stateful net-to-net).
- Add most of the support for the dynamic NAT rules; a little bit more
  userland work is needed to finish this up and enable.
- Replace 'stateful-ends' with more permissive 'stateful-all'.
- Add various tunable parameters and document them, see npf-params(7).
- Reduce the memory usage of the connection state table (conndb).
- Portmap rewrite: use memory more efficiently, handle addresses dynamically.
- Bug fix: add splsoftnet()/splx() around the thmap writers and comment.
- npftest: clean up and simplify; fix some memleaks to make ASAN happy.

Revision 1.50.2.1 / (download) - annotate - [select for diffs], Mon Jun 10 22:09:46 2019 UTC (4 years, 9 months ago) by christos
Branch: phil-wifi
Changes since 1.50: +112 -18 lines
Diff to previous 1.50 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.37.12.8 / (download) - annotate - [select for diffs], Sat Jan 26 22:00:37 2019 UTC (5 years, 2 months ago) by pgoyette
Branch: pgoyette-compat
CVS Tags: pgoyette-compat-merge-20190127
Changes since 1.37.12.7: +35 -5 lines
Diff to previous 1.37.12.7 (colored) to branchpoint 1.37 (colored) next main 1.38 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.53 / (download) - annotate - [select for diffs], Sat Jan 19 21:19:32 2019 UTC (5 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: phil-wifi-20190609, pgoyette-compat-20190127, isaki-audio2-base, isaki-audio2
Changes since 1.52: +35 -5 lines
Diff to previous 1.52 (colored)

Major NPF improvements:
- Convert NPF connection table to thmap.  State lookup is now lock-free.
- Improve connection state G/C: it is now incremental and tunable.
- Add support for dynamic NAT address.  Translation addresses can now be
  selected from a pool of addresses.  There are two selection algorithms,
  "ip-hash" and "round-robin" (see the man page).
- Translation address can be specified as e.g. ifaddrs(wm0) in npf.conf
  to dynamically choose an IP from the interface address(es).
- Add support for the NETMAP algorithm with static NAT for net-to-net
  translation (it is equivalent to iptables NETMAP logic).
- Convert 'ipset' tables to use thmap; the table lookup is now lock-free.
- Misc improvements, bug fixes and more unit tests.
- Bump NPF_VERSION (will also bump libnpf).

Revision 1.37.12.7 / (download) - annotate - [select for diffs], Sun Sep 30 01:45:56 2018 UTC (5 years, 5 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37.12.6: +1 -3 lines
Diff to previous 1.37.12.6 (colored) to branchpoint 1.37 (colored) to selected 1.52 (colored)

Ssync with HEAD

Revision 1.52 / (download) - annotate - [selected], Sat Sep 29 14:41:36 2018 UTC (5 years, 5 months ago) by rmind
Branch: MAIN
CVS Tags: pgoyette-compat-20190118, pgoyette-compat-1226, pgoyette-compat-1126, pgoyette-compat-1020, pgoyette-compat-0930
Changes since 1.51: +1 -3 lines
Diff to previous 1.51 (colored)

NPF: Major rework -- migrate NPF to the libnv library.
- This conversion significantly simplifies the code and moves NPF to
  a binary serialisation format (replacing the XML-like format).
- Fix some memory/reference leaks and possibly use-after-free bugs.
- Bump NPF_VERSION as this change makes libnpf incompatible with the
  previous versions.  Also, different serialisation format means NPF
  connection/config saving and loading is not compatible with the
  previous versions either.

Thanks to christos@ for extra testing.

Revision 1.37.12.6 / (download) - annotate - [select for diffs], Thu Sep 6 06:56:44 2018 UTC (5 years, 6 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37.12.5: +79 -13 lines
Diff to previous 1.37.12.5 (colored) to branchpoint 1.37 (colored) to selected 1.52 (colored)

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

Revision 1.51 / (download) - annotate - [select for diffs], Fri Aug 31 14:16:06 2018 UTC (5 years, 6 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0906
Changes since 1.50: +79 -13 lines
Diff to previous 1.50 (colored) to selected 1.52 (colored)

Introduce npf_set_mss(). When the MSS is not 16bit-aligned, it sets:

	0      8           16          24    32
	+------+-----------+-----------+------+
	| data | MSS (low) | MSS (hig) | data |
	+------+-----------+-----------+------+
	^                  ^
	old[0]             old[1]

And sets new[0,1] accordingly with the new value. The MSS-clamping code
then adjusts twice the checksum on a 16bit boundary:

	from old[0] to new[0]
	from old[1] to new[1]

Fixes PR/53479, opened by myself. Tested with wireshark and kASan.

Revision 1.10.4.9.2.2 / (download) - annotate - [select for diffs], Thu May 17 13:47:24 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-6-1
Changes since 1.10.4.9.2.1: +9 -4 lines
Diff to previous 1.10.4.9.2.1 (colored) to branchpoint 1.10.4.9 (colored) next main 1.10.4.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) via patch (requested by maxv in ticket #1549):

	sys/net/npf/npf_inet.c: revision 1.45
	sys/net/npf/npf_alg_icmp.c: revision 1.27,1.28

Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.

We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).

Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.

Discussed with rmind@.

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.
Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.

In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).

This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Revision 1.10.4.11 / (download) - annotate - [select for diffs], Thu May 17 13:45:15 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-6
Changes since 1.10.4.10: +9 -4 lines
Diff to previous 1.10.4.10 (colored) to branchpoint 1.10 (colored) next main 1.11 (colored) to selected 1.52 (colored)

Pull up following revision(s) via patch (requested by maxv in ticket #1549):

	sys/net/npf/npf_inet.c: revision 1.45
	sys/net/npf/npf_alg_icmp.c: revision 1.27,1.28

Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.

We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).

Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.

Discussed with rmind@.

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.
Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.

In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).

This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Revision 1.37.6.2 / (download) - annotate - [select for diffs], Mon May 14 19:22:30 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-8
CVS Tags: netbsd-8-2-RELEASE, netbsd-8-1-RELEASE, netbsd-8-1-RC1, netbsd-8-0-RELEASE, netbsd-8-0-RC2
Changes since 1.37.6.1: +33 -12 lines
Diff to previous 1.37.6.1 (colored) to branchpoint 1.37 (colored) next main 1.38 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by maxv in ticket #823):

	sys/net/npf/npf_inet.c: revision 1.45-1.47
	sys/net/npf/npf_alg_icmp.c: revision 1.27-1.30
	sys/net/npf/npf_sendpkt.c: revision 1.19

Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.

We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).
Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.

Discussed with rmind@.

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.
Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.

In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).

This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Retrieve the complete IPv4 header right away, and make sure we did retrieve
the IPv6 option header we were iterating on.

Ah, fix compilation. I tested my previous change by loading the kernel
module from the filesystem, but the Makefile didn't have DIAGNOSTIC
enabled, and the two KASSERTs I added did not compile properly.

If we fail to advance inside TCP/UDP/ICMPv4/ICMPv6, stop pretending L4
is unknown, and error out right away.

This prevents bugs in machinery, if a place looks for L4 in 'npc_proto'
without checking the cache too. I've seen a ~similar problem already.

In addition to checking L4 in the cache, here we also need to check the
protocol. The NPF entry point does not ensure that
        ICMPv6 can be set only in IPv6
        ICMPv4 can be set only in IPv4
So we could have ICMPv6 in IPv4.

apply some INET6 so this compiles in INET6-less kernels again.

Revision 1.32.6.1 / (download) - annotate - [select for diffs], Mon May 14 19:03:48 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-7-0
Changes since 1.32: +9 -4 lines
Diff to previous 1.32 (colored) next main 1.33 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by maxv in ticket #1605):

        sys/net/npf/npf_inet.c: revision 1.45
        sys/net/npf/npf_alg_icmp.c: revision 1.27-1.29

Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.
We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).
Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.
Discussed with rmind@.

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.
Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.
In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).
This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Ah, fix compilation. I tested my previous change by loading the kernel
module from the filesystem, but the Makefile didn't have DIAGNOSTIC
enabled, and the two KASSERTs I added did not compile properly.

Revision 1.32.10.1 / (download) - annotate - [select for diffs], Mon May 14 16:17:19 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-7-1
Changes since 1.32: +9 -4 lines
Diff to previous 1.32 (colored) next main 1.33 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by maxv in ticket #1605):

	sys/net/npf/npf_inet.c: revision 1.45
	sys/net/npf/npf_alg_icmp.c: revision 1.27-1.29

Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.
We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).
Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.
Discussed with rmind@.

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.
Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.
In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).
This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Ah, fix compilation. I tested my previous change by loading the kernel
module from the filesystem, but the Makefile didn't have DIAGNOSTIC
enabled, and the two KASSERTs I added did not compile properly.

Revision 1.32.2.3 / (download) - annotate - [select for diffs], Mon May 14 16:16:04 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-7
CVS Tags: netbsd-7-2-RELEASE
Changes since 1.32.2.2: +9 -4 lines
Diff to previous 1.32.2.2 (colored) to branchpoint 1.32 (colored) next main 1.33 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by maxv in ticket #1605):

	sys/net/npf/npf_inet.c: revision 1.45
	sys/net/npf/npf_alg_icmp.c: revision 1.27-1.29

Fix use-after-free.

The nbuf can be reallocated as a result of caching 'enpc', so it is
necessary to recache 'npc', otherwise it contains pointers to the freed
mbuf - pointers which are then used in the ruleset machinery.
We recache 'npc' when we are sure we won't use 'enpc' anymore, because
'enpc' can be clobbered as a result of caching 'npc' (in other words,
only one of the two can be cached at the same time).
Also, we recache 'npc' unconditionally, because there is no way to know
whether the nbuf got clobbered relatively to it. We can't use the
NBUF_DATAREF_RESET flag, because it is stored in the nbuf and not in the
cache.
Discussed with rmind@.

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.
Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.
In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).
This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Ah, fix compilation. I tested my previous change by loading the kernel
module from the filesystem, but the Makefile didn't have DIAGNOSTIC
enabled, and the two KASSERTs I added did not compile properly.

Revision 1.37.6.1 / (download) - annotate - [select for diffs], Wed May 9 15:35:37 2018 UTC (5 years, 10 months ago) by martin
Branch: netbsd-8
Changes since 1.37: +47 -41 lines
Diff to previous 1.37 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by maxv in ticket #817):

	sys/net/npf/npf_inet.c: revision 1.38-1.44
	sys/net/npf/npf_handler.c: revision 1.38-1.39
	sys/net/npf/npf_alg_icmp.c: revision 1.26
	sys/net/npf/npf.h: revision 1.56
	sys/net/npf/npf_sendpkt.c: revision 1.17-1.18

Declare NPC_FMTERR, and use it to kick malformed packets. Several sanity
checks are added in IPv6; after we see the first IPPROTO_FRAGMENT header,
we are allowed to fail to advance, otherwise we kick the packet.
Sent on tech-net@ a few days ago, no response, but I'm committing it now
anyway.

Switch nptr to uint8_t, and use nbuf_ensure_contig. Makes us use fewer
magic values.

Remove dead branches, 'npc' can't be NULL (and it is dereferenced
earlier).

Fix two consecutive mistakes.

The first mistake was npf_inet.c rev1.37:
        "Don't reassemble ipv6 fragments, instead treat the first fragment
        as a regular packet (subject to filtering rules), and pass
        subsequent fragments in the same group unconditionally."

Doing this was entirely wrong, because then a packet just had to push
the L4 payload in a secondary fragment, and NPF wouldn't apply rules on
it - meaning any IPv6 packet could bypass >=L4 filtering. This mistake
was supposed to be a fix for the second mistake.

The second mistake was that ip6_reass_packet (in npf_reassembly) was
getting called with npc->npc_hlen. But npc_hlen pointed to the last
encountered header in the IPv6 chain, which was not necessarily the
fragment header. So ip6_reass_packet was given garbage, and would fail,
resulting in the packet getting kicked. So basically IPv6 was broken by
NPF.

The first mistake is reverted, and the second one is fixed by doing:
-                       hlen = sizeof(struct ip6_frag);
+                       hlen = 0;

Now the iteration stops on the fragment header, and the call to
ip6_reass_packet is valid.

My npf_inet.c rev1.38 is partially reverted: we don't need to worry
about failing properly to advance; once the packet is reassembled
npf_cache_ip gets called again, and this time the whole chain should be
there.

Tested with a simple UDPv6 server - send a 3000-byte-sized buffer, the
packet gets correctly reassembled by NPF now.

Mmh, put back the RFC6946 check (about dummy fragments), otherwise NPF
is not happy in npf_reassembly, because NPC_IPFRAG is again returned after
the packet was reassembled.

I'm wondering whether it would not be better to just remove the fragment
header in frag6_input directly.

Fix the "return-rst" rule on IPv6 packets.
The scopes needed to be set on the addresses before invoking ip6_output,
because ip6_output needs them. The reason they are not here already is
because pfil_run_hooks (in ip6_input) is called _before_ the kernel
initializes the scopes.

Until now ip6_output was always failing, and the IPv6-TCP-RST packet was
never actually sent.

Perhaps it would be better to have the kernel initialize the scopes
before invoking pfil_run_hooks, but several things will need to be fixed
in several places.

Tested with a simple TCPv6 server. Until now the client would block
waiting for an answer that never came; now it receives an RST right away
and closes the connection, as expected.
I believe that the same problem exists in the "return-icmp" rules, but I
can't investigate this right now (some problems with wireshark).

Fix the IPv6 payload computation in npf_tcpsaw. It was incorrect, and this
caused the "return-rst" rules to send back an RST with the wrong ACK when
the received SYN had an IPv6 option.

Set the scopes before calling icmp6_error(). This fixes a bug similar to
the one I fixed in rev1.17: since the scopes were not set the packet was
never actually sent.

Tested with wireshark, now the ICMPv6 reply is correctly sent, as
expected.

Don't read the L4 payload after IPPROTO_AH when handling IPv6 packets.
AH must be considered as the payload, otherwise a

        block all
        pass in proto ah from any
        pass out proto ah from any

configuration will actually block everything, because NPF checks the
protocol against the one found after AH, and not AH itself.

In addition it may have been a problem for stateful connections; an AH
packet sent by an attacker with an incorrect authentication and a correct
TCP/UDP/whatever payload from an active connection could manage to change
NPF's FSM state, which would perhaps have altered the legitimate
connection with the authenticated remote IPsec host.

Note that IPv4 already doesn't go beyond AH, which is the correct
behavior.

Add XXX (we don't handle IPv6 Jumbograms), and whitespace.

Revision 1.37.12.5 / (download) - annotate - [select for diffs], Mon Apr 16 02:00:08 2018 UTC (5 years, 11 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37.12.4: +45 -62 lines
Diff to previous 1.37.12.4 (colored) to branchpoint 1.37 (colored) to selected 1.52 (colored)

Sync with HEAD, resolve some conflicts

Revision 1.50 / (download) - annotate - [select for diffs], Sun Apr 8 05:51:45 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
CVS Tags: phil-wifi-base, pgoyette-compat-0728, pgoyette-compat-0625, pgoyette-compat-0521, pgoyette-compat-0502, pgoyette-compat-0422, pgoyette-compat-0415
Branch point for: phil-wifi
Changes since 1.49: +3 -3 lines
Diff to previous 1.49 (colored) to selected 1.52 (colored)

Fix bug I introduced in previous commit.

Revision 1.49 / (download) - annotate - [select for diffs], Sat Apr 7 09:06:26 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
Changes since 1.48: +45 -62 lines
Diff to previous 1.48 (colored) to selected 1.52 (colored)

Rewrite npf_fetch_tcpopts:

 * Instead of doing several nbuf_advance/nbuf_ensure_contig and
   playing with gotos, fetch the TCP options only once, and iterate over
   the (safe) area. The code is similar to tcp_dooptions.

 * When handling TCPOPT_MAXSEG and TCPOPT_WINDOW, ensure the length is
   the one we're expecting. If it isn't, then skip the option. This
   wasn't done before, and not doing it allowed a packet to bypass the
   max-mss clamping procedure. Discussed on tech-net@.

Revision 1.37.12.4 / (download) - annotate - [select for diffs], Sat Apr 7 04:12:19 2018 UTC (5 years, 11 months ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37.12.3: +9 -3 lines
Diff to previous 1.37.12.3 (colored) to branchpoint 1.37 (colored) to selected 1.52 (colored)

Sync with HEAD.  77 conflicts resolved - all of them $NetBSD$

Revision 1.48 / (download) - annotate - [select for diffs], Fri Apr 6 14:50:55 2018 UTC (5 years, 11 months ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0407
Changes since 1.47: +9 -3 lines
Diff to previous 1.47 (colored) to selected 1.52 (colored)

If we're trying to read the mss on a packet that for some reason has two
MAXSEG options, we find ourselves patching the second option with the
value of the first one.

Fix that by using a local variable.

Revision 1.37.12.3 / (download) - annotate - [select for diffs], Fri Mar 30 06:20:16 2018 UTC (6 years ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37.12.2: +33 -12 lines
Diff to previous 1.37.12.2 (colored) to branchpoint 1.37 (colored) to selected 1.52 (colored)

Resolve conflicts between branch and HEAD

Revision 1.47 / (download) - annotate - [select for diffs], Fri Mar 23 08:28:54 2018 UTC (6 years ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0330
Changes since 1.46: +16 -9 lines
Diff to previous 1.46 (colored) to selected 1.52 (colored)

If we fail to advance inside TCP/UDP/ICMPv4/ICMPv6, stop pretending L4
is unknown, and error out right away.

This prevents bugs in machinery, if a place looks for L4 in 'npc_proto'
without checking the cache too. I've seen a ~similar problem already.

Revision 1.46 / (download) - annotate - [select for diffs], Thu Mar 22 09:04:25 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.45: +12 -3 lines
Diff to previous 1.45 (colored) to selected 1.52 (colored)

Retrieve the complete IPv4 header right away, and make sure we did retrieve
the IPv6 option header we were iterating on.

Revision 1.45 / (download) - annotate - [select for diffs], Thu Mar 22 08:57:47 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.44: +9 -4 lines
Diff to previous 1.44 (colored) to selected 1.52 (colored)

Change npf_cache_all so that it ensures the potential ICMP Query Id is in
the nbuf. In such a way that we don't need to ensure that later.

Change npfa_icmp4_inspect and npfa_icmp6_inspect so that they touch neither
the nbuf nor npc. Adapt their callers accordingly.

In the end, if a packet has a Query Id, we set NPC_ICMP_ID in npc and leave
right away, without recaching npc (not needed since we didn't touch the
nbuf).

This fixes the handling of Query Id packets (that I broke in my previous
commit), and also fixes another possible use-after-free.

Revision 1.37.12.2 / (download) - annotate - [select for diffs], Thu Mar 22 01:44:51 2018 UTC (6 years ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37.12.1: +13 -7 lines
Diff to previous 1.37.12.1 (colored) to branchpoint 1.37 (colored) to selected 1.52 (colored)

Synch with HEAD, resolve conflicts

Revision 1.44 / (download) - annotate - [select for diffs], Wed Mar 21 15:36:28 2018 UTC (6 years ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0322
Changes since 1.43: +7 -3 lines
Diff to previous 1.43 (colored) to selected 1.52 (colored)

Add XXX (we don't handle IPv6 Jumbograms), and whitespace.

Revision 1.43 / (download) - annotate - [select for diffs], Wed Mar 21 10:08:16 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.42: +6 -5 lines
Diff to previous 1.42 (colored) to selected 1.52 (colored)

Don't read the L4 payload after IPPROTO_AH when handling IPv6 packets.

AH must be considered as the payload, otherwise a

	block all
	pass in proto ah from any
	pass out proto ah from any

configuration will actually block everything, because NPF checks the
protocol against the one found after AH, and not AH itself.

In addition it may have been a problem for stateful connections; an AH
packet sent by an attacker with an incorrect authentication and a correct
TCP/UDP/whatever payload from an active connection could manage to change
NPF's FSM state, which would perhaps have altered the legitimate
connection with the authenticated remote IPsec host.

Note that IPv4 already doesn't go beyond AH, which is the correct
behavior.

Revision 1.42 / (download) - annotate - [select for diffs], Sat Mar 17 10:21:09 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.41: +4 -3 lines
Diff to previous 1.41 (colored) to selected 1.52 (colored)

Fix the IPv6 payload computation in npf_tcpsaw. It was incorrect, and this
caused the "return-rst" rules to send back an RST with the wrong ACK when
the received SYN had an IPv6 option.

Revision 1.37.12.1 / (download) - annotate - [select for diffs], Thu Mar 15 09:12:06 2018 UTC (6 years ago) by pgoyette
Branch: pgoyette-compat
Changes since 1.37: +36 -36 lines
Diff to previous 1.37 (colored) to selected 1.52 (colored)

Synch with HEAD

Revision 1.41 / (download) - annotate - [select for diffs], Tue Mar 13 16:23:40 2018 UTC (6 years ago) by maxv
Branch: MAIN
CVS Tags: pgoyette-compat-0315
Changes since 1.40: +9 -2 lines
Diff to previous 1.40 (colored) to selected 1.52 (colored)

Mmh, put back the RFC6946 check (about dummy fragments), otherwise NPF
is not happy in npf_reassembly, because NPC_IPFRAG is again returned after
the packet was reassembled.

I'm wondering whether it would not be better to just remove the fragment
header in frag6_input directly.

Revision 1.40 / (download) - annotate - [select for diffs], Tue Mar 13 09:04:02 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.39: +4 -40 lines
Diff to previous 1.39 (colored) to selected 1.52 (colored)

Fix two consecutive mistakes.

The first mistake was npf_inet.c rev1.37:

	"Don't reassemble ipv6 fragments, instead treat the first fragment
	as a regular packet (subject to filtering rules), and pass
	subsequent fragments in the same group unconditionally."

Doing this was entirely wrong, because then a packet just had to push
the L4 payload in a secondary fragment, and NPF wouldn't apply rules on
it - meaning any IPv6 packet could bypass >=L4 filtering. This mistake
was supposed to be a fix for the second mistake.

The second mistake was that ip6_reass_packet (in npf_reassembly) was
getting called with npc->npc_hlen. But npc_hlen pointed to the last
encountered header in the IPv6 chain, which was not necessarily the
fragment header. So ip6_reass_packet was given garbage, and would fail,
resulting in the packet getting kicked. So basically IPv6 was broken by
NPF.

The first mistake is reverted, and the second one is fixed by doing:

-			hlen = sizeof(struct ip6_frag);
+			hlen = 0;

Now the iteration stops on the fragment header, and the call to
ip6_reass_packet is valid.

My npf_inet.c rev1.38 is partially reverted: we don't need to worry
about failing properly to advance; once the packet is reassembled
npf_cache_ip gets called again, and this time the whole chain should be
there.

Tested with a simple UDPv6 server - send a 3000-byte-sized buffer, the
packet gets correctly reassembled by NPF now.

Revision 1.39 / (download) - annotate - [select for diffs], Thu Mar 8 07:54:14 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.38: +14 -14 lines
Diff to previous 1.38 (colored) to selected 1.52 (colored)

Switch nptr to uint8_t, and use nbuf_ensure_contig. Makes us use fewer
magic values.

Revision 1.38 / (download) - annotate - [select for diffs], Thu Mar 8 07:06:13 2018 UTC (6 years ago) by maxv
Branch: MAIN
Changes since 1.37: +44 -15 lines
Diff to previous 1.37 (colored) to selected 1.52 (colored)

Declare NPC_FMTERR, and use it to kick malformed packets. Several sanity
checks are added in IPv6; after we see the first IPPROTO_FRAGMENT header,
we are allowed to fail to advance, otherwise we kick the packet.

Sent on tech-net@ a few days ago, no response, but I'm committing it now
anyway.

Revision 1.16.2.5 / (download) - annotate - [select for diffs], Sun Dec 3 11:39:03 2017 UTC (6 years, 3 months ago) by jdolecek
Branch: tls-maxphys
Changes since 1.16.2.4: +31 -14 lines
Diff to previous 1.16.2.4 (colored) next main 1.17 (colored) to selected 1.52 (colored)

update from HEAD

Revision 1.32.4.5 / (download) - annotate - [select for diffs], Mon Aug 28 17:53:11 2017 UTC (6 years, 7 months ago) by skrll
Branch: nick-nhusb
Changes since 1.32.4.4: +17 -3 lines
Diff to previous 1.32.4.4 (colored) to branchpoint 1.32 (colored) next main 1.33 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.32.2.2 / (download) - annotate - [select for diffs], Mon May 22 18:56:35 2017 UTC (6 years, 10 months ago) by martin
Branch: netbsd-7
Changes since 1.32.2.1: +3 -2 lines
Diff to previous 1.32.2.1 (colored) to branchpoint 1.32 (colored) to selected 1.52 (colored)

Pull up missing part of rev 1.33, partly pulled up in ticket #1394:
make DDB print ipv6 addresses too

Revision 1.32.2.1 / (download) - annotate - [select for diffs], Fri May 12 05:32:12 2017 UTC (6 years, 10 months ago) by snj
Branch: netbsd-7
Changes since 1.32: +13 -3 lines
Diff to previous 1.32 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by jnemeth in ticket #1394):
	sys/net/npf/npf_inet.c: revisions 1.34, 1.35 via patch
	sys/net/npf/npf_mbuf.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.40
minimal changes necessary to link into an INET6-less kernel.
--
fixup misplaced #endif

Revision 1.36.2.1 / (download) - annotate - [select for diffs], Fri Apr 21 16:54:05 2017 UTC (6 years, 11 months ago) by bouyer
Branch: bouyer-socketcan
Changes since 1.36: +17 -3 lines
Diff to previous 1.36 (colored) next main 1.37 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.34.2.2 / (download) - annotate - [select for diffs], Mon Mar 20 06:57:50 2017 UTC (7 years ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.34.2.1: +17 -3 lines
Diff to previous 1.34.2.1 (colored) to branchpoint 1.34 (colored) next main 1.35 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.37 / (download) - annotate - [select for diffs], Sun Feb 19 20:27:22 2017 UTC (7 years, 1 month ago) by christos
Branch: MAIN
CVS Tags: tls-maxphys-base-20171202, prg-localcount2-base3, prg-localcount2-base2, prg-localcount2-base1, prg-localcount2-base, prg-localcount2, pgoyette-localcount-20170426, pgoyette-localcount-20170320, pgoyette-compat-base, perseant-stdc-iso10646-base, perseant-stdc-iso10646, nick-nhusb-base-20170825, netbsd-8-base, netbsd-8-0-RC1, matt-nb8-mediatek-base, matt-nb8-mediatek, jdolecek-ncq-base, jdolecek-ncq, bouyer-socketcan-base1
Branch point for: pgoyette-compat, netbsd-8
Changes since 1.36: +17 -3 lines
Diff to previous 1.36 (colored) to selected 1.52 (colored)

Don't reassemble ipv6 fragments, instead treat the first fragment as a regular
packet (subject to filtering rules), and pass subsequent fragments in the
same group unconditionally.

Revision 1.32.4.4 / (download) - annotate - [select for diffs], Sun Feb 5 13:40:58 2017 UTC (7 years, 1 month ago) by skrll
Branch: nick-nhusb
Changes since 1.32.4.3: +17 -25 lines
Diff to previous 1.32.4.3 (colored) to branchpoint 1.32 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.34.2.1 / (download) - annotate - [select for diffs], Sat Jan 7 08:56:50 2017 UTC (7 years, 2 months ago) by pgoyette
Branch: pgoyette-localcount
Changes since 1.34: +17 -25 lines
Diff to previous 1.34 (colored) to selected 1.52 (colored)

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revision 1.36 / (download) - annotate - [select for diffs], Mon Dec 26 23:05:06 2016 UTC (7 years, 3 months ago) by christos
Branch: MAIN
CVS Tags: pgoyette-localcount-20170107, nick-nhusb-base-20170204, bouyer-socketcan-base
Branch point for: bouyer-socketcan
Changes since 1.35: +15 -23 lines
Diff to previous 1.35 (colored) to selected 1.52 (colored)

Sync NPF with the version on github: backport standalone NPF changes,
which allow us to create and run separate NPF instances. Minor fixes.
(from rmind@)

Revision 1.32.4.3 / (download) - annotate - [select for diffs], Mon Dec 5 10:55:28 2016 UTC (7 years, 3 months ago) by skrll
Branch: nick-nhusb
Changes since 1.32.4.2: +3 -3 lines
Diff to previous 1.32.4.2 (colored) to branchpoint 1.32 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.35 / (download) - annotate - [select for diffs], Mon Nov 7 18:16:07 2016 UTC (7 years, 4 months ago) by jnemeth
Branch: MAIN
CVS Tags: nick-nhusb-base-20161204
Changes since 1.34: +3 -3 lines
Diff to previous 1.34 (colored) to selected 1.52 (colored)

fixup misplaced #endif

Revision 1.32.4.2 / (download) - annotate - [select for diffs], Sat Mar 19 11:30:32 2016 UTC (8 years ago) by skrll
Branch: nick-nhusb
Changes since 1.32.4.1: +12 -2 lines
Diff to previous 1.32.4.1 (colored) to branchpoint 1.32 (colored) to selected 1.52 (colored)

Sync with HEAD

Revision 1.34 / (download) - annotate - [select for diffs], Fri Mar 18 10:09:46 2016 UTC (8 years ago) by mrg
Branch: MAIN
CVS Tags: pgoyette-localcount-base, pgoyette-localcount-20161104, pgoyette-localcount-20160806, pgoyette-localcount-20160726, nick-nhusb-base-20161004, nick-nhusb-base-20160907, nick-nhusb-base-20160529, nick-nhusb-base-20160422, nick-nhusb-base-20160319, localcount-20160914
Branch point for: pgoyette-localcount
Changes since 1.33: +12 -2 lines
Diff to previous 1.33 (colored) to selected 1.52 (colored)

minimal changes necessary to link into an INET6-less kernel.

Revision 1.32.4.1 / (download) - annotate - [select for diffs], Sun Dec 27 12:10:07 2015 UTC (8 years, 3 months ago) by skrll
Branch: nick-nhusb
Changes since 1.32: +4 -3 lines
Diff to previous 1.32 (colored) to selected 1.52 (colored)

Sync with HEAD (as of 26th Dec)

Revision 1.33 / (download) - annotate - [select for diffs], Thu Dec 17 12:17:13 2015 UTC (8 years, 3 months ago) by mlelstv
Branch: MAIN
CVS Tags: nick-nhusb-base-20151226
Changes since 1.32: +4 -3 lines
Diff to previous 1.32 (colored) to selected 1.52 (colored)

make DDB print ipv6 addresses too

Revision 1.16.2.4 / (download) - annotate - [select for diffs], Wed Aug 20 00:04:35 2014 UTC (9 years, 7 months ago) by tls
Branch: tls-maxphys
Changes since 1.16.2.3: +183 -48 lines
Diff to previous 1.16.2.3 (colored) to selected 1.52 (colored)

Rebase to HEAD as of a few days ago.

Revision 1.30.2.1 / (download) - annotate - [select for diffs], Sun Aug 10 06:56:16 2014 UTC (9 years, 7 months ago) by tls
Branch: tls-earlyentropy
Changes since 1.30: +19 -12 lines
Diff to previous 1.30 (colored) next main 1.31 (colored) to selected 1.52 (colored)

Rebase.

Revision 1.32 / (download) - annotate - [select for diffs], Sun Jul 20 00:37:41 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
CVS Tags: tls-maxphys-base, tls-earlyentropy-base, nick-nhusb-base-20150921, nick-nhusb-base-20150606, nick-nhusb-base-20150406, nick-nhusb-base, netbsd-7-nhusb-base-20170116, netbsd-7-nhusb-base, netbsd-7-nhusb, netbsd-7-base, netbsd-7-1-RELEASE, netbsd-7-1-RC2, netbsd-7-1-RC1, netbsd-7-1-2-RELEASE, netbsd-7-1-1-RELEASE, netbsd-7-0-RELEASE, netbsd-7-0-RC3, netbsd-7-0-RC2, netbsd-7-0-RC1, netbsd-7-0-2-RELEASE, netbsd-7-0-1-RELEASE
Branch point for: nick-nhusb, netbsd-7-1, netbsd-7-0, netbsd-7
Changes since 1.31: +11 -7 lines
Diff to previous 1.31 (colored) to selected 1.52 (colored)

NPF: add nbuf_t * into npf_cache_t and remove unnecessary carrying by argument.

Revision 1.31 / (download) - annotate - [select for diffs], Sat Jul 19 18:24:16 2014 UTC (9 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.30: +10 -7 lines
Diff to previous 1.30 (colored) to selected 1.52 (colored)

NPF: partially rewrite the connection tracking mechanism:
- Separate the tracking interface from the storage (state table)
  and thus prepare to use a new data structure for the storage.
- Fix some race conditions in NAT association logic.

Revision 1.6.8.6 / (download) - annotate - [select for diffs], Thu May 22 11:41:09 2014 UTC (9 years, 10 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.8.5: +173 -45 lines
Diff to previous 1.6.8.5 (colored) to branchpoint 1.6 (colored) next main 1.7 (colored) to selected 1.52 (colored)

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

Revision 1.22.2.2 / (download) - annotate - [select for diffs], Sun May 18 17:46:13 2014 UTC (9 years, 10 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.22.2.1: +162 -39 lines
Diff to previous 1.22.2.1 (colored) to branchpoint 1.22 (colored) next main 1.23 (colored) to selected 1.52 (colored)

sync with head

Revision 1.30 / (download) - annotate - [select for diffs], Wed Feb 19 03:51:31 2014 UTC (10 years, 1 month ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base9, rmind-smpnet-nbase, rmind-smpnet-base, riastradh-xf86-video-intel-2-7-1-pre-2-21-15, riastradh-drm2-base3
Branch point for: tls-earlyentropy
Changes since 1.29: +47 -3 lines
Diff to previous 1.29 (colored) to selected 1.52 (colored)

NPF: fix the recent breakage of the traceroute ALG.  Also, simplify and
refactor a little bit.

Revision 1.29 / (download) - annotate - [select for diffs], Thu Feb 13 03:34:40 2014 UTC (10 years, 1 month ago) by rmind
Branch: MAIN
Changes since 1.28: +76 -3 lines
Diff to previous 1.28 (colored) to selected 1.52 (colored)

NPF: add support for IPv6-to-IPv6 Network Prefix Translation (NPTv6),
as per RFC 6296.  Add a unit test.  Also, bump NPF_VERSION.

Thanks to S.P.Zeidler for the help with NPTv6 work!

Revision 1.28 / (download) - annotate - [select for diffs], Fri Dec 6 01:33:37 2013 UTC (10 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.27: +18 -22 lines
Diff to previous 1.27 (colored) to selected 1.52 (colored)

NPF:
- Adjust NAT to not assume flow direction in some cases and thus support
  less usual setups which are possible when using 'map' with a custom
  filter criteria.
- Introduce NPF_SRC/NPF_DST and replace npc_src/npc_dst with npc_ips[2]
  for more convenient handling.
- ICMP ALG: restrict matching only to the outgoing traffic, but be more
  direction-agnostic elsewhere.

Revision 1.27 / (download) - annotate - [select for diffs], Fri Nov 22 01:48:36 2013 UTC (10 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.26: +20 -9 lines
Diff to previous 1.26 (colored) to selected 1.52 (colored)

Optimise checksum fixup routines:
- npf_fixup16_cksum: 1's complement sum is endian-independent.
- npf_fixup32_cksum: the first 32->16 bit reduction is not needed.

Pointed out by Valery Ushakov.

Revision 1.26 / (download) - annotate - [select for diffs], Fri Nov 22 01:24:21 2013 UTC (10 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.25: +7 -8 lines
Diff to previous 1.25 (colored) to selected 1.52 (colored)

npf_addr_mix: use xor rather than sum.

Revision 1.25 / (download) - annotate - [select for diffs], Wed Oct 30 08:41:38 2013 UTC (10 years, 5 months ago) by mrg
Branch: MAIN
Changes since 1.24: +3 -3 lines
Diff to previous 1.24 (colored) to selected 1.52 (colored)

used __diagused where appropriate.

Revision 1.24 / (download) - annotate - [select for diffs], Fri Oct 25 11:35:55 2013 UTC (10 years, 5 months ago) by martin
Branch: MAIN
Changes since 1.23: +3 -3 lines
Diff to previous 1.23 (colored) to selected 1.52 (colored)

Turn a few __unused into __diagused

Revision 1.10.4.9.2.1 / (download) - annotate - [select for diffs], Fri Sep 13 04:17:41 2013 UTC (10 years, 6 months ago) by msaitoh
Branch: netbsd-6-1
CVS Tags: netbsd-6-1-5-RELEASE, netbsd-6-1-4-RELEASE, netbsd-6-1-3-RELEASE, netbsd-6-1-2-RELEASE
Changes since 1.10.4.9: +8 -3 lines
Diff to previous 1.10.4.9 (colored) to selected 1.52 (colored)

Pull up following revision (requested by riz in ticket #942):
     /sys/net/npf/npf_inet.c		revision 1.23
Fix bugs to prevent panic:
- npf_cache_ip: re-fetch IPv6 header since nbufs might have been reallocated.
- npf_cache_all: clear NBUF_DATAREF_RESET since npf_cache_ip() handles it.

Revision 1.10.4.10 / (download) - annotate - [select for diffs], Fri Sep 13 04:12:54 2013 UTC (10 years, 6 months ago) by msaitoh
Branch: netbsd-6
Changes since 1.10.4.9: +8 -3 lines
Diff to previous 1.10.4.9 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision (requested by riz in ticket #942):
     /sys/net/npf/npf_inet.c		revision 1.23
Fix bugs to prevent panic:
- npf_cache_ip: re-fetch IPv6 header since nbufs might have been reallocated.
- npf_cache_all: clear NBUF_DATAREF_RESET since npf_cache_ip() handles it.

Revision 1.22.2.1 / (download) - annotate - [select for diffs], Wed Aug 28 23:59:36 2013 UTC (10 years, 7 months ago) by rmind
Branch: rmind-smpnet
Changes since 1.22: +8 -3 lines
Diff to previous 1.22 (colored) to selected 1.52 (colored)

sync with head

Revision 1.23 / (download) - annotate - [select for diffs], Fri Aug 23 10:37:03 2013 UTC (10 years, 7 months ago) by rmind
Branch: MAIN
Changes since 1.22: +8 -3 lines
Diff to previous 1.22 (colored) to selected 1.52 (colored)

- npf_cache_ip: re-fetch IPv6 header since nbufs might have been reallocated.
- npf_cache_all: clear NBUF_DATAREF_RESET since npf_cache_ip() handles it.

Revision 1.16.2.3 / (download) - annotate - [select for diffs], Sun Jun 23 06:20:25 2013 UTC (10 years, 9 months ago) by tls
Branch: tls-maxphys
Changes since 1.16.2.2: +3 -3 lines
Diff to previous 1.16.2.2 (colored) to selected 1.52 (colored)

resync from head

Revision 1.22 / (download) - annotate - [select for diffs], Sun Jun 2 02:20:04 2013 UTC (10 years, 9 months ago) by rmind
Branch: MAIN
CVS Tags: riastradh-drm2-base2, riastradh-drm2-base1, riastradh-drm2-base, riastradh-drm2
Branch point for: rmind-smpnet
Changes since 1.21: +3 -3 lines
Diff to previous 1.21 (colored) to selected 1.52 (colored)

- NPF connection tracking: rework synchronisation on tracking disable/enable
  points and document it.  Split the worker thread into a separate module
  with an interface, so it could be re-used for other tasks.
- Replace ALG list with arrays and thus hit fewer cache lines.
- Misc bug fixes.

Revision 1.16.2.2 / (download) - annotate - [select for diffs], Mon Feb 25 00:30:03 2013 UTC (11 years, 1 month ago) by tls
Branch: tls-maxphys
Changes since 1.16.2.1: +214 -268 lines
Diff to previous 1.16.2.1 (colored) to selected 1.52 (colored)

resync with head

Revision 1.10.4.9 / (download) - annotate - [select for diffs], Mon Feb 11 21:49:49 2013 UTC (11 years, 1 month ago) by riz
Branch: netbsd-6
CVS Tags: netbsd-6-1-RELEASE, netbsd-6-1-RC4, netbsd-6-1-RC3, netbsd-6-1-RC2, netbsd-6-1-RC1, netbsd-6-1-1-RELEASE
Branch point for: netbsd-6-1
Changes since 1.10.4.8: +6 -6 lines
Diff to previous 1.10.4.8 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #817):
	usr.sbin/npf/npfctl/npfctl.8: revision 1.12
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.27
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.20
	usr.sbin/npf/npfctl/npfctl.c: revision 1.28
	lib/libnpf/npf.c: revision 1.16
	usr.sbin/npf/npfctl/npfctl.c: revision 1.29
	lib/libnpf/npf.c: revision 1.17
	sys/modules/npf/Makefile: revision 1.12
	sys/net/npf/npf_rproc.c: revision 1.6
	usr.sbin/npf/npftest/README: revision 1.4
	sys/net/npf/npf_tableset.c: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.21
	sys/net/npf/npf_ctl.c: revision 1.22
	usr.sbin/npf/npfctl/npfctl.h: revision 1.25
	lib/libnpf/npf.h: revision 1.13
	usr.sbin/npf/npftest/npftest.conf: revision 1.2
	usr.sbin/npf/npfctl/npfctl.h: revision 1.26
	sys/net/npf/npf_ruleset.c: revision 1.17
	lib/libnpf/npf.h: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.18
	sys/net/npf/npf_conf.c: revision 1.1
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.10
	sys/net/npf/npf_conf.c: revision 1.2
	sys/net/npf/npf_instr.c: revision 1.16
	sys/net/npf/npf_handler.c: revision 1.26
	sys/net/npf/npf_impl.h: revision 1.26
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.14
	sys/net/npf/npf_processor.c: revision 1.15
	sys/net/npf/npf_impl.h: revision 1.27
	sys/net/npf/npf_alg_icmp.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.15
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.16
	sys/net/npf/npf_ncode.h: revision 1.11
	sys/net/npf/files.npf: revision 1.10
	usr.sbin/npf/npftest/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.c: revision 1.30
	lib/libnpf/npf.3: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.21
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.5
	usr.sbin/npf/npfctl/npf_build.c: revision 1.18
	usr.sbin/npf/npfctl/npf_build.c: revision 1.19
	sys/net/npf/npf_alg.c: revision 1.7
	usr.sbin/npf/npfctl/Makefile: revision 1.10
	sys/net/npf/npf_inet.c: revision 1.21
	sys/net/npf/npf.h: revision 1.26
	sys/net/npf/npf.h: revision 1.27
	usr.sbin/pf/ftp-proxy/Makefile: revision 1.8
	sys/net/npf/npf_nat.c: revision 1.19
	sys/net/npf/npf.c: revision 1.15
	sys/net/npf/npf_state.c: revision 1.14
	sys/net/npf/npf_sendpkt.c: revision 1.14
	sys/rump/net/lib/libnpf/Makefile: revision 1.4
IPv6 linklocal address printing cosmetics
NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.
Disable -DWITH_NPF for now; will be converted to BPF mechanism.
- Fix NPF config reload with dynamic rules present.
- Implement list and flush commands on a dynamic ruleset.
Allow filtering on IP addresses even if the L4 protocol is unknown.
Patch from spz@.
npftest: adjust for recent change.

Revision 1.21 / (download) - annotate - [select for diffs], Sat Feb 9 03:35:32 2013 UTC (11 years, 1 month ago) by rmind
Branch: MAIN
CVS Tags: khorben-n900, agc-symver-base, agc-symver
Changes since 1.20: +6 -6 lines
Diff to previous 1.20 (colored) to selected 1.52 (colored)

NPF:
- Implement dynamic NPF rules.  Controlled through npf(3) library of via
  npfctl rule command.  A rule can be removed using a unique identifier,
  returned on addition, or using a key which is SHA1 hash of the rule.
  Adjust npftest and add a regression test.
- Improvements to rule inspection mechanism.
- Initial BPF support as an alternative to n-code.
- Minor fixes; bump the version.

Revision 1.10.4.8 / (download) - annotate - [select for diffs], Fri Feb 8 19:18:09 2013 UTC (11 years, 1 month ago) by riz
Branch: netbsd-6
Changes since 1.10.4.7: +190 -259 lines
Diff to previous 1.10.4.7 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #777):
	usr.sbin/npf/npfctl/npfctl.c: revision 1.27
	sys/net/npf/npf_session.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.4
	sys/net/npf/npf_rproc.c: revision 1.5
	usr.sbin/npf/npftest/README: revision 1.3
	sys/sys/mbuf.h: revision 1.151
	sys/net/npf/npf_ruleset.c: revision 1.15
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.3
	sys/net/npf/npf_ruleset.c: revision 1.16
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.4
	usr.sbin/npf/npftest/libnpftest/npf_nbuf_test.c: revision 1.4
	sys/net/npf/npf_inet.c: revision 1.19
	sys/net/npf/npf_instr.c: revision 1.15
	sys/net/npf/npf_handler.c: revision 1.24
	sys/net/npf/npf_handler.c: revision 1.25
	sys/net/npf/npf_state_tcp.c: revision 1.12
	sys/net/npf/npf_processor.c: revision 1.13
	sys/net/npf/npf_impl.h: revision 1.25
	sys/net/npf/npf_processor.c: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.10
	sys/net/npf/npf_alg_icmp.c: revision 1.14
	sys/net/npf/npf_mbuf.c: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_nat_test.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_rule_test.c: revision 1.3
	sys/net/npf/npf_session.c: revision 1.20
	sys/net/npf/npf_alg.c: revision 1.6
	sys/kern/uipc_mbuf.c: revision 1.148
	sys/net/npf/npf_inet.c: revision 1.20
	sys/net/npf/npf.h: revision 1.25
	sys/net/npf/npf_nat.c: revision 1.18
	sys/net/npf/npf_state.c: revision 1.13
	sys/net/npf/npf_sendpkt.c: revision 1.13
	sys/net/npf/npf_ext_log.c: revision 1.2
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.4
	sys/net/npf/npf_ext_normalise.c: revision 1.2
- Rework NPF's nbuf interface: use advancing and ensuring as a main method.
  Eliminate unnecessary copy and simplify.  Adapt regression tests.
- Simplify ICMP ALG a little.  While here, handle ICMP ECHO for traceroute.
- Minor fixes, misc cleanup.
Silence gcc in npf_recache().
Add m_ensure_contig() routine, which is equivalent to m_pullup, but does not
destroy the mbuf chain on failure (it is kept valid).
- nbuf_ensure_contig: rework to use m_ensure_contig(9), which will not free
  the mbuf chain on failure.  Fixes some corner cases.  Improve regression
  test and sprinkle some asserts.
- npf_reassembly: clear nbuf on IPv6 reassembly failure path (partial fix).
  The problem was found and fix provided by Anthony Mallet.

Revision 1.6.8.5 / (download) - annotate - [select for diffs], Wed Jan 23 00:06:25 2013 UTC (11 years, 2 months ago) by yamt
Branch: yamt-pagecache
CVS Tags: yamt-pagecache-tag8
Changes since 1.6.8.4: +190 -259 lines
Diff to previous 1.6.8.4 (colored) to branchpoint 1.6 (colored) to selected 1.52 (colored)

sync with head

Revision 1.6.8.4 / (download) - annotate - [select for diffs], Wed Jan 16 05:33:49 2013 UTC (11 years, 2 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.8.3: +38 -23 lines
Diff to previous 1.6.8.3 (colored) to branchpoint 1.6 (colored) to selected 1.52 (colored)

sync with (a bit old) head

Revision 1.20 / (download) - annotate - [select for diffs], Mon Dec 24 23:11:25 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base8
Changes since 1.19: +3 -3 lines
Diff to previous 1.19 (colored) to selected 1.52 (colored)

Silence gcc in npf_recache().

Revision 1.19 / (download) - annotate - [select for diffs], Mon Dec 24 19:05:43 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
Changes since 1.18: +190 -259 lines
Diff to previous 1.18 (colored) to selected 1.52 (colored)

- Rework NPF's nbuf interface: use advancing and ensuring as a main method.
  Eliminate unnecessary copy and simplify.  Adapt regression tests.
- Simplify ICMP ALG a little.  While here, handle ICMP ECHO for traceroute.
- Minor fixes, misc cleanup.

Revision 1.10.4.5.4.1 / (download) - annotate - [select for diffs], Sun Dec 16 18:20:09 2012 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6-0
CVS Tags: netbsd-6-0-6-RELEASE, netbsd-6-0-5-RELEASE, netbsd-6-0-4-RELEASE, netbsd-6-0-3-RELEASE, netbsd-6-0-2-RELEASE, netbsd-6-0-1-RELEASE
Changes since 1.10.4.5: +38 -23 lines
Diff to previous 1.10.4.5 (colored) next main 1.10.4.6 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #746):
	sys/net/npf/npf_inet.c: revision 1.18
	sys/net/npf/npf_mbuf.c: revision 1.8
	sys/net/npf/npf.h: revision 1.23
npf_rwrcksum: handle delayed checksums in the network stack; also fix
non-NPF_NAT_PORTS case and add some comments.  PR/47235.

Revision 1.10.4.7 / (download) - annotate - [select for diffs], Sun Dec 16 18:19:52 2012 UTC (11 years, 3 months ago) by riz
Branch: netbsd-6
Changes since 1.10.4.6: +38 -23 lines
Diff to previous 1.10.4.6 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #746):
	sys/net/npf/npf_inet.c: revision 1.18
	sys/net/npf/npf_mbuf.c: revision 1.8
	sys/net/npf/npf.h: revision 1.23
npf_rwrcksum: handle delayed checksums in the network stack; also fix
non-NPF_NAT_PORTS case and add some comments.  PR/47235.

Revision 1.18 / (download) - annotate - [select for diffs], Mon Dec 10 01:11:13 2012 UTC (11 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base7
Changes since 1.17: +38 -23 lines
Diff to previous 1.17 (colored) to selected 1.52 (colored)

npf_rwrcksum: handle delayed checksums in the network stack; also fix
non-NPF_NAT_PORTS case and add some comments.  PR/47235.

Revision 1.16.2.1 / (download) - annotate - [select for diffs], Tue Nov 20 03:02:47 2012 UTC (11 years, 4 months ago) by tls
Branch: tls-maxphys
Changes since 1.16: +2 -116 lines
Diff to previous 1.16 (colored) to selected 1.52 (colored)

Resync to 2012-11-19 00:00:00 UTC

Revision 1.10.4.6 / (download) - annotate - [select for diffs], Sun Nov 18 22:38:25 2012 UTC (11 years, 4 months ago) by riz
Branch: netbsd-6
Changes since 1.10.4.5: +2 -116 lines
Diff to previous 1.10.4.5 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #693):
	lib/npf/ext_normalise/shlib_version: revision 1.1
	lib/libnpf/npf.c: revision 1.13
	distrib/sets/lists/modules/mi: revision 1.48
	sys/net/npf/npf_rproc.c: revision 1.3
	sys/net/npf/npf_rproc.c: revision 1.4
	sys/modules/npf/Makefile: revision 1.11
	usr.sbin/npf/npfctl/npfctl.h: revision 1.20
	lib/npf/ext_log/npfext_log.c: revision 1.1
	lib/libnpf/npf.h: revision 1.11
	sys/net/npf/npf_inet.c: revision 1.17
	sys/net/npf/npf_log.c: file removal
	sys/net/npf/npf_handler.c: revision 1.22
	distrib/sets/lists/base/shl.mi: revision 1.636
	sys/net/npf/npf_impl.h: revision 1.23
	usr.sbin/npf/npfctl/Makefile: revision 1.8
	lib/npf/Makefile: revision 1.1
	lib/npf/ext_log/shlib_version: revision 1.1
	lib/Makefile: revision 1.189
	distrib/sets/lists/comp/shl.mi: revision 1.236
	usr.sbin/npf/npfctl/npf_build.c: revision 1.14
	distrib/sets/lists/base/mi: revision 1.1007
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.6
	distrib/sets/lists/base/mi: revision 1.1009
	sys/net/npf/npf.h: revision 1.21
	lib/npf/ext_normalise/npfext_normalise.c: revision 1.1
	etc/mtree/NetBSD.dist.base: revision 1.105
	lib/libnpf/Makefile: revision 1.3
	etc/mtree/NetBSD.dist.base: revision 1.106
	usr.sbin/npf/npfctl/npf_extmod.c: revision 1.1
	sys/net/npf/npf_ctl.c: revision 1.18
	lib/npf/ext_log/Makefile: revision 1.1
	distrib/sets/lists/comp/mi: revision 1.1781
	usr.sbin/npf/npfctl/npf_var.h: revision 1.4
	sys/net/npf/npf.c: revision 1.13
	sys/modules/Makefile: revision 1.111
	sys/net/npf/npf_ext_log.c: revision 1.1
	lib/npf/Makefile.inc: revision 1.1
	sys/net/npf/npf_ext_normalise.c: revision 1.1
	sys/net/npf/files.npf: revision 1.8
	sys/rump/net/lib/libnpf/Makefile: revision 1.2
	sys/modules/npf_ext_log/Makefile: revision 1.1
	lib/npf/ext_normalise/Makefile: revision 1.1
	usr.sbin/npf/npfctl/npfctl.c: revision 1.20
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.13
	sys/modules/npf_ext_normalise/Makefile: revision 1.1
Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.
Add /usr/lib/npf.
Add ./usr/libdata/debug/usr/lib/npf for rmind
Fix MKDEBUG set lists
ext_ops does not change during the life cycle and can be fetched without
the mutex held. This avoids confusion in the compiler about an uninitialized
variable ext_ops.
ok rmind@

Revision 1.6.8.3 / (download) - annotate - [select for diffs], Tue Oct 30 17:22:44 2012 UTC (11 years, 5 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.8.2: +140 -172 lines
Diff to previous 1.6.8.2 (colored) to branchpoint 1.6 (colored) to selected 1.52 (colored)

sync with head

Revision 1.17 / (download) - annotate - [select for diffs], Sun Sep 16 13:47:41 2012 UTC (11 years, 6 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base6
Changes since 1.16: +2 -116 lines
Diff to previous 1.16 (colored) to selected 1.52 (colored)

Implement dynamic NPF extensions interface.  An extension consists of
dynamically loaded module (.so) supplementing npfctl(8) and a kernel
module.  Move normalisation and logging functionality into their own
extensions.  More improvements to come.

Revision 1.10.4.5 / (download) - annotate - [select for diffs], Wed Jul 25 20:45:23 2012 UTC (11 years, 8 months ago) by jdc
Branch: netbsd-6
CVS Tags: netbsd-6-0-RELEASE, netbsd-6-0-RC2, netbsd-6-0-RC1, matt-nb6-plus-nbase, matt-nb6-plus-base, matt-nb6-plus
Branch point for: netbsd-6-0
Changes since 1.10.4.4: +10 -5 lines
Diff to previous 1.10.4.4 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up revisions:
  src/usr.sbin/npf/npfctl/npfctl.c revisions 1.16,1.17
  src/sys/net/npf/npf.h revision 1.20
  src/sys/net/npf/npf_alg_icmp.c revision 1.11
  src/sys/net/npf/npf_impl.h revision 1.19
  src/sys/net/npf/npf_inet.c revisions 1.15,1.16
  src/sys/net/npf/npf_instr.c revision 1.14
  src/sys/net/npf/npf_ncode.h revision 1.10
  src/sys/net/npf/npf_processor.c revision 1.12
  src/sys/net/npf/npf_session.c revision 1.16
  src/usr.sbin/npf/npfctl/npf_build.c revision 1.12
  src/usr.sbin/npf/npfctl/npf_data.c revisions 1.16,1.17
  src/usr.sbin/npf/npfctl/npf_disassemble.c revision 1.8
  src/usr.sbin/npf/npfctl/npf_ncgen.c revision 1.13
  src/usr.sbin/npf/npfctl/npf_parse.y revision 1.11
  src/usr.sbin/npf/npfctl/npf_scan.l revision 1.5
  src/usr.sbin/npf/npfctl/npf_var.h revision 1.3
  src/usr.sbin/npf/npfctl/npfctl.h revision 1.18
  src/sys/net/npf/npf_state.c revision 1.10
  src/sys/net/npf/npf_state_tcp.c revision 1.10
  src/usr.sbin/npf/npftest/npfstream.c revision 1.2
  src/usr.sbin/npf/npftest/libnpftest/npf_test_subr.c revision 1.2
(requested by rmind in ticket #435).

Add missing __dead.

teach npf ipv6-icmp
reviewed by rmind@

- npfctl_print_stats: beautification a la French style.
- npfctl_icmpcode: fix the build break.

- npf_fetch_tcpopts: fix off-by-one when validating TCP option length
  against the maximum allowed.
- npf_tcp_inwindow: be more liberal with npf_fetch_tcpopts().
- Few minor improvements to npftest.

Revision 1.16 / (download) - annotate - [select for diffs], Sat Jul 21 17:11:01 2012 UTC (11 years, 8 months ago) by rmind
Branch: MAIN
Branch point for: tls-maxphys
Changes since 1.15: +3 -3 lines
Diff to previous 1.15 (colored) to selected 1.52 (colored)

- npf_fetch_tcpopts: fix off-by-one when validating TCP option length
  against the maximum allowed.
- npf_tcp_inwindow: be more liberal with npf_fetch_tcpopts().
- Few minor improvements to npftest.

Revision 1.15 / (download) - annotate - [select for diffs], Thu Jul 19 21:52:29 2012 UTC (11 years, 8 months ago) by spz
Branch: MAIN
Changes since 1.14: +9 -4 lines
Diff to previous 1.14 (colored) to selected 1.52 (colored)

teach npf ipv6-icmp
reviewed by rmind@

Revision 1.10.4.4 / (download) - annotate - [select for diffs], Mon Jul 16 22:13:25 2012 UTC (11 years, 8 months ago) by riz
Branch: netbsd-6
Changes since 1.10.4.3: +10 -12 lines
Diff to previous 1.10.4.3 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #421):
	lib/libnpf/npf.c: revision 1.10
	sys/net/npf/npf_session.c: revision 1.15
	sys/net/npf/npf_tableset.c: revision 1.13
	sys/net/npf/npf_state_tcp.c: revision 1.9
	usr.sbin/npf/npfctl/npf_data.c: revision 1.15
	sys/net/npf/npf_inet.c: revision 1.14
	sys/net/npf/npf_ruleset.c: revision 1.13
	sys/net/npf/npf.h: revision 1.19
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.12
	sys/net/npf/npf_instr.c: revision 1.13
	sys/net/npf/npf_handler.c: revision 1.20
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.4
	sys/net/npf/npf_alg_icmp.c: revision 1.10
	usr.sbin/npf/npfctl/npfctl.c: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.11
	lib/libnpf/npf.h: revision 1.9
	sys/net/npf/npf_alg.c: revision 1.5
	sys/rump/dev/lib/libnpf/Makefile: revision 1.4
	usr.sbin/npf/npfctl/npfctl.h: revision 1.17
	sys/net/npf/npf_ctl.c: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.15
	sys/net/npf/npf_tableset_ptree.c: revision 1.1
	sys/net/npf/npf.c: revision 1.12
	sys/net/npf/npf_sendpkt.c: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.7
	sys/net/npf/npf_impl.h: revision 1.18
	sys/net/npf/files.npf: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.10
- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.14 / (download) - annotate - [select for diffs], Sun Jul 15 00:23:00 2012 UTC (11 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.13: +10 -12 lines
Diff to previous 1.13 (colored) to selected 1.52 (colored)

- Rework NPF tables and fix support for IPv6.  Implement tree table type
  using radix / Patricia tree.  Universal IPv4/IPv6 comparator for ptree(3)
  was contributed by Matt Thomas.
- NPF tables: update regression tests, improve npfctl(8) error messages.
- Fix few bugs when using kernel modules and handle module autounloader.
- Few other fixes and misc cleanups.
- Bump the version.

Revision 1.10.4.3 / (download) - annotate - [select for diffs], Thu Jul 5 17:48:42 2012 UTC (11 years, 8 months ago) by riz
Branch: netbsd-6
Changes since 1.10.4.2: +61 -70 lines
Diff to previous 1.10.4.2 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #399):
	sys/net/npf/npf_session.c: revision 1.14
	sys/net/npf/npf_tableset.c: revision 1.12
	sys/net/npf/npf_state_tcp.c: revision 1.8
	usr.sbin/npf/npftest/libnpftest/npf_mbuf_subr.c: revision 1.3
	usr.sbin/npf/npfctl/npf_data.c: revision 1.14
	sys/net/npf/npf_inet.c: revision 1.13
	sys/net/npf/npf_ruleset.c: revision 1.12
	sys/net/npf/npf.h: revision 1.18
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.8: revision 1.7
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.9
	usr.sbin/npf/npftest/libnpftest/npf_state_test.c: revision 1.2
	usr.sbin/npf/npfctl/npfctl.8: revision 1.8
	sys/net/npf/npf_instr.c: revision 1.12
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.3
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.13
	usr.sbin/npf/npfctl/npf.conf.5: revision 1.14
	sys/net/npf/npf_state.c: revision 1.9
	sys/net/npf/npf_processor.c: revision 1.11
	usr.sbin/npf/npfctl/npfctl.c: revision 1.13
	usr.sbin/npf/npfctl/npfctl.c: revision 1.14
	usr.sbin/npf/npfctl/npf_build.c: revision 1.10
	lib/libnpf/npf.3: revision 1.5
	lib/libnpf/npf.h: revision 1.8
	share/man/man9/npf_ncode.9: revision 1.9
	usr.sbin/npf/npfctl/npf_scan.l: revision 1.4
	lib/libnpf/npf.c: revision 1.9
	usr.sbin/npf/npfctl/npfctl.h: revision 1.16
	sys/net/npf/npf_nat.c: revision 1.14
	usr.sbin/npf/npftest/libnpftest/npf_processor_test.c: revision 1.2
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.6
	sys/net/npf/npf_impl.h: revision 1.17
	sys/net/npf/npf_handler.c: revision 1.18
	sys/net/npf/npf_handler.c: revision 1.19
	usr.sbin/npf/npftest/libnpftest/npf_test.h: revision 1.4
	sys/net/npf/npf_ncode.h: revision 1.9
Fix and update npf.conf(5), npfctl(8) and its usage message.
npf_state_tcp: fix for FIN retransmission and out-of-order ACK case.
NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.
npf_packet_handler: fix gcc unused warning.

Revision 1.13 / (download) - annotate - [select for diffs], Sun Jul 1 23:21:06 2012 UTC (11 years, 8 months ago) by rmind
Branch: MAIN
Changes since 1.12: +61 -70 lines
Diff to previous 1.12 (colored) to selected 1.52 (colored)

NPF improvements:
- Add NPF_OPCODE_PROTO to match the address and/or protocol only.
- Update parser to support arbitrary "pass proto <name/number>".
- Fix IPv6 address and protocol handling (add a regression test).
- Fix few theorethical races in session handling module.
- Misc fixes, simplifications and some clean up.

Revision 1.10.4.2 / (download) - annotate - [select for diffs], Tue Jun 26 14:49:10 2012 UTC (11 years, 9 months ago) by riz
Branch: netbsd-6
Changes since 1.10.4.1: +122 -34 lines
Diff to previous 1.10.4.1 (colored) to branchpoint 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #365):
	sys/rump/librump/rumpkern/rumpcpu_generic.c: revision 1.4
	sys/net/npf/npf_session.c: revision 1.13
	sys/net/npf/npf_tableset.c: revision 1.11
	sys/net/npf/npf_state_tcp.c: revision 1.7
	sys/net/npf/npf_inet.c: revision 1.12
	sys/net/npf/npf.h: revision 1.17
	sys/net/npf/npf_instr.c: revision 1.11
	usr.sbin/npf/npftest/libnpftest/npf_table_test.c: revision 1.2
	sys/net/npf/npf_state.c: revision 1.8
	sys/net/npf/npf_log.c: revision 1.4
	sys/net/npf/npf_alg.c: revision 1.4
	sys/rump/librump/rumpkern/Makefile.rumpkern: revision 1.118
	sys/net/npf/npf_nat.c: revision 1.13
	sys/net/npf/npf.c: revision 1.11
	sys/net/npf/npf_sendpkt.c: revision 1.11
	sys/net/npf/npf_impl.h: revision 1.16
	sys/rump/librump/rumpkern/scheduler.c: revision 1.28
rumpkern:
- Add subr_kcpuset.c and subr_pserialize.c modules.
- Add kcpuset_{running,attached} for RUMP env.
NPF:
- Rename some functions for consistency and de-inline them.
- Fix few invalid asserts (add regressoin test).
- Use pserialize(9) for ALG interface.
- Minor fixes, sprinkle many comments.

Revision 1.12 / (download) - annotate - [select for diffs], Fri Jun 22 13:43:17 2012 UTC (11 years, 9 months ago) by rmind
Branch: MAIN
Changes since 1.11: +122 -34 lines
Diff to previous 1.11 (colored) to selected 1.52 (colored)

NPF:
- Rename some functions for consistency and de-inline them.
- Fix few invalid asserts (add regressoin test).
- Use pserialize(9) for ALG interface.
- Minor fixes, sprinkle many comments.

Revision 1.6.8.2 / (download) - annotate - [select for diffs], Tue Apr 17 00:08:39 2012 UTC (11 years, 11 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6.8.1: +42 -36 lines
Diff to previous 1.6.8.1 (colored) to branchpoint 1.6 (colored) to selected 1.52 (colored)

sync with head

Revision 1.10.4.1 / (download) - annotate - [select for diffs], Tue Apr 3 17:22:52 2012 UTC (11 years, 11 months ago) by riz
Branch: netbsd-6
Changes since 1.10: +3 -3 lines
Diff to previous 1.10 (colored) to selected 1.52 (colored)

Pull up following revision(s) (requested by rmind in ticket #158):
	sys/net/npf/npf_session.c: revision 1.12
	sys/net/npf/npf_tableset.c: revision 1.10
	sys/net/npf/npf_rproc.c: revision 1.2
	usr.sbin/npf/npfctl/npf_parse.y: revision 1.4
	sys/net/npf/npf_inet.c: revision 1.11
	sys/net/npf/npf.h: revision 1.15
	usr.sbin/npf/npfctl/npf_build.c: revision 1.5
	sys/net/npf/npf_ruleset.c: revision 1.11
	sys/net/npf/npf_instr.c: revision 1.10
	usr.sbin/npf/npfctl/Makefile: revision 1.6
	sys/net/npf/npf_processor.c: revision 1.10
	sys/net/npf/npf_log.c: revision 1.3
	lib/libnpf/npf.h: revision 1.7
	sys/net/npf/npf_alg.c: revision 1.3
	sys/net/npf/npf_sendpkt.c: revision 1.9
	lib/libnpf/npf.c: revision 1.8
	usr.sbin/npf/npfctl/npfctl.h: revision 1.13
	sys/net/npf/npf_ctl.c: revision 1.13
	usr.sbin/npf/npfctl/npf_ncgen.c: revision 1.8
	sys/net/npf/npf_ctl.c: revision 1.14
	sys/net/npf/npf_nat.c: revision 1.11
	sys/net/npf/npf_nat.c: revision 1.12
	sys/net/npf/npf_impl.h: revision 1.11
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.1
	sys/net/npf/npf_impl.h: revision 1.12
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.2
	sys/net/npf/npf_handler.c: revision 1.14
	usr.sbin/npf/npfctl/npf_disassemble.c: revision 1.3
	sys/net/npf/npf_handler.c: revision 1.15
	sys/net/npf/npf_ncode.h: revision 1.6
	sys/net/npf/npf.c: revision 1.8
	sys/net/npf/npf.c: revision 1.9
	sys/net/npf/npf_alg_icmp.c: revision 1.9
	sys/net/npf/npf_session.c: revision 1.11
- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS.  Be more defensive in the
  packet handler.  Change the default policy to block when the config is
  loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
  of rule procedure might happen in the interrupt handler (under a very rare
  condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.
Simplify slightly: merge iface into addr_or_iface, use it in filt_addr.
Add a small disassembler.
definitions used by the disassembler.
- better printing of type/code flags/mask
- pass the instruction start pointer, instead of subtracting 1 to account for it
- Save active config in proplib dictionary; add GETCONF ioctl to retrieve.
- Few fixes.  Improve some comments.
don't leak the branch target array.
Add NPF config retrieval routines.

Revision 1.10.2.1 / (download) - annotate - [select for diffs], Fri Feb 24 09:11:49 2012 UTC (12 years, 1 month ago) by mrg
Branch: jmcneill-usbmp
Changes since 1.10: +3 -3 lines
Diff to previous 1.10 (colored) next main 1.11 (colored) to selected 1.52 (colored)

sync to -current.

Revision 1.11 / (download) - annotate - [select for diffs], Mon Feb 20 00:18:19 2012 UTC (12 years, 1 month ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base5, yamt-pagecache-base4, jmcneill-usbmp-base9, jmcneill-usbmp-base8, jmcneill-usbmp-base7, jmcneill-usbmp-base6, jmcneill-usbmp-base5, jmcneill-usbmp-base4, jmcneill-usbmp-base3, jmcneill-usbmp-base10
Changes since 1.10: +3 -3 lines
Diff to previous 1.10 (colored) to selected 1.52 (colored)

- Add NPF_DECISION_BLOCK and NPF_DECISION_PASS.  Be more defensive in the
  packet handler.  Change the default policy to block when the config is
  loaded and set it to pass when flush operation is performed.
- Use kmem_zalloc(9) instead of kmem_alloc(9) in few places.
- npf_rproc_{create,release}: use kmem_intr_{alloc,free} as the destruction
  of rule procedure might happen in the interrupt handler (under a very rare
  condition, if config reload races with the handler).
- npf_session_establish: check whether layer 3 and 4 are cached.
- npfctl_build_group: do not make groups as passing rules.
- Remove some unecessary header inclusion.

Revision 1.10 / (download) - annotate - [select for diffs], Tue Nov 29 20:05:30 2011 UTC (12 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: netbsd-6-base, jmcneill-usbmp-pre-base2, jmcneill-usbmp-base2, jmcneill-usbmp-base
Branch point for: netbsd-6, jmcneill-usbmp
Changes since 1.9: +40 -34 lines
Diff to previous 1.9 (colored) to selected 1.52 (colored)

- Rework and improve TCP state tracking.
- Fix regressions after IPv6 patch merge.

Note: npfctl(8) rework will come soon.

Revision 1.9 / (download) - annotate - [select for diffs], Sat Nov 12 14:51:41 2011 UTC (12 years, 4 months ago) by jakllsch
Branch: MAIN
CVS Tags: jmcneill-audiomp3-base, jmcneill-audiomp3
Changes since 1.8: +3 -3 lines
Diff to previous 1.8 (colored) to selected 1.52 (colored)

Make a comment consistent with the code.

Revision 1.6.8.1 / (download) - annotate - [select for diffs], Thu Nov 10 14:31:50 2011 UTC (12 years, 4 months ago) by yamt
Branch: yamt-pagecache
Changes since 1.6: +85 -26 lines
Diff to previous 1.6 (colored) to selected 1.52 (colored)

sync with head

Revision 1.8 / (download) - annotate - [select for diffs], Sun Nov 6 02:49:03 2011 UTC (12 years, 4 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base3, yamt-pagecache-base2
Changes since 1.7: +20 -17 lines
Diff to previous 1.7 (colored) to selected 1.52 (colored)

Few fixes, KNF/style, bump the NPF version.

Revision 1.7 / (download) - annotate - [select for diffs], Fri Nov 4 01:00:27 2011 UTC (12 years, 4 months ago) by zoltan
Branch: MAIN
Changes since 1.6: +82 -26 lines
Diff to previous 1.6 (colored) to selected 1.52 (colored)

Add IPv6 support for NPF.

Revision 1.5.2.1 / (download) - annotate - [select for diffs], Mon Jun 6 09:09:53 2011 UTC (12 years, 9 months ago) by jruoho
Branch: jruoho-x86intr
Changes since 1.5: +18 -30 lines
Diff to previous 1.5 (colored) next main 1.6 (colored) to selected 1.52 (colored)

Sync with HEAD.

Revision 1.6.4.2 / (download) - annotate - [select for diffs], Sat Mar 5 20:55:55 2011 UTC (13 years ago) by rmind
Branch: rmind-uvmplock
Changes since 1.6.4.1: +639 -0 lines
Diff to previous 1.6.4.1 (colored) to branchpoint 1.6 (colored) next main 1.7 (colored) to selected 1.52 (colored)

sync with head

Revision 1.6.4.1, Tue Jan 18 20:33:45 2011 UTC (13 years, 2 months ago) by rmind
Branch: rmind-uvmplock
Changes since 1.6: +0 -639 lines
FILE REMOVED

file npf_inet.c was added on branch rmind-uvmplock on 2011-03-05 20:55:55 +0000

Revision 1.6 / (download) - annotate - [select for diffs], Tue Jan 18 20:33:45 2011 UTC (13 years, 2 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-pagecache-base, rmind-uvmplock-nbase, rmind-uvmplock-base, cherry-xenmp-base, cherry-xenmp, bouyer-quota2-nbase, bouyer-quota2-base, bouyer-quota2
Branch point for: yamt-pagecache, rmind-uvmplock
Changes since 1.5: +18 -30 lines
Diff to previous 1.5 (colored) to selected 1.52 (colored)

NPF checkpoint:
- Add the concept of rule procedure: separate normalization, logging and
  potentially other functions from the rule structure.  Rule procedure can be
  shared amongst the rules.  Separation is both at kernel level (npf_rproc_t)
  and configuration ("procedure" + "apply").
- Fix portmap sharing for NAT policy.
- Update TCP state tracking logic.  Use TCP FSM definitions.
- Add if_byindex(), OK by matt@.  Use in logging for the lookup.
- Fix traceroute ALG and many other bugs; misc clean-up.

Revision 1.5 / (download) - annotate - [select for diffs], Sat Dec 18 01:07:25 2010 UTC (13 years, 3 months ago) by rmind
Branch: MAIN
CVS Tags: matt-mips64-premerge-20101231, jruoho-x86intr-base
Branch point for: jruoho-x86intr
Changes since 1.4: +24 -6 lines
Diff to previous 1.4 (colored) to selected 1.52 (colored)

NPF checkpoint:
- Add support for session saving/restoring.
- Add packet logging support (can tcpdump a pseudo-interface).
- Support reload without flushing of sessions; rework some locking.
- Revisit session mangement, replace linking with npf_sentry_t entries.
- Add some counters for statistics, using percpu(9).
- Add IP_DF flag cleansing.
- Fix various bugs; misc clean-up.

Revision 1.4 / (download) - annotate - [select for diffs], Thu Nov 11 06:30:39 2010 UTC (13 years, 4 months ago) by rmind
Branch: MAIN
Changes since 1.3: +444 -197 lines
Diff to previous 1.3 (colored) to selected 1.52 (colored)

NPF checkpoint:
- Add proper TCP state tracking as described in Guido van Rooij paper,
  plus handle TCP Window Scaling option.
- Completely rework npf_cache_t, reduce granularity, simplify code.
- Add npf_addr_t as an abstraction, amend session handling code, as well
  as NAT code et al, to use it.  Now design is prepared for IPv6 support.
- Handle IPv4 fragments i.e. perform packet reassembly.
- Add support for IPv4 ID randomization and minimum TTL enforcement.
- Add support for TCP MSS "clamping".
- Random bits for IPv6.  Various fixes and clean-up.

Revision 1.3.4.2 / (download) - annotate - [select for diffs], Fri Oct 22 09:23:15 2010 UTC (13 years, 5 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.3.4.1: +386 -0 lines
Diff to previous 1.3.4.1 (colored) to branchpoint 1.3 (colored) next main 1.4 (colored) to selected 1.52 (colored)

Sync with HEAD (-D20101022).

Revision 1.3.2.2 / (download) - annotate - [select for diffs], Sat Oct 9 03:32:37 2010 UTC (13 years, 5 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.3.2.1: +386 -0 lines
Diff to previous 1.3.2.1 (colored) to branchpoint 1.3 (colored) next main 1.4 (colored) to selected 1.52 (colored)

sync with head

Revision 1.3.4.1, Sat Sep 25 00:25:31 2010 UTC (13 years, 6 months ago) by uebayasi
Branch: uebayasi-xip
Changes since 1.3: +0 -386 lines
FILE REMOVED

file npf_inet.c was added on branch uebayasi-xip on 2010-10-22 09:23:15 +0000

Revision 1.3.2.1, Sat Sep 25 00:25:31 2010 UTC (13 years, 6 months ago) by yamt
Branch: yamt-nfs-mp
Changes since 1.3: +0 -386 lines
FILE REMOVED

file npf_inet.c was added on branch yamt-nfs-mp on 2010-10-09 03:32:37 +0000

Revision 1.3 / (download) - annotate - [select for diffs], Sat Sep 25 00:25:31 2010 UTC (13 years, 6 months ago) by rmind
Branch: MAIN
CVS Tags: yamt-nfs-mp-base11, uebayasi-xip-base4, uebayasi-xip-base3
Branch point for: yamt-nfs-mp, uebayasi-xip
Changes since 1.2: +19 -35 lines
Diff to previous 1.2 (colored) to selected 1.52 (colored)

Add nbuf_advfetch() and simplify some code slightly.

Revision 1.2 / (download) - annotate - [select for diffs], Thu Sep 16 04:53:27 2010 UTC (13 years, 6 months ago) by rmind
Branch: MAIN
Changes since 1.1: +8 -16 lines
Diff to previous 1.1 (colored) to selected 1.52 (colored)

NPF checkpoint:
- Add support for bi-directional NAT and redirection / port forwarding.
- Finish filtering on ICMP type/code and add filtering on TCP flags.
- Add support for TCP reset (RST) or ICMP destination unreachable on block.
- Fix a bunch of bugs; misc cleanup.

Revision 1.1 / (download) - annotate - [select for diffs], Sun Aug 22 18:56:22 2010 UTC (13 years, 7 months ago) by rmind
Branch: MAIN
Diff to selected 1.52 (colored)

Import NPF - a packet filter.  Some features:

- Designed to be fully MP-safe and highly efficient.

- Tables/IP sets (hash or red-black tree) for high performance lookups.

- Stateful filtering and Network Address Port Translation (NAPT).
  Framework for application level gateways (ALGs).

- Packet inspection engine called n-code processor - inspired by BPF -
  supporting generic RISC-like and specific CISC-like instructions for
  common patterns (e.g. IPv4 address matching).  See npf_ncode(9) manual.

- Convenient userland utility npfctl(8) with npf.conf(8).

NOTE: This is not yet a fully capable alternative to PF or IPFilter.
Further work (support for binat/rdr, return-rst/return-icmp, common ALGs,
state saving/restoring, logging, etc) is in progress.

Thanks a lot to Matt Thomas for various useful comments and code review.
Aye by: board@

This form allows you to request diff's between any two revisions of a file. You may select a symbolic revision name using the selection box or you may type in a numeric name using the type-in text box.




CVSweb <webmaster@jp.NetBSD.org>